T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cw_client.cjs:17- Finding
Hardcoded Shared API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Interactive Architecture Diagram
Security checks for vulnerabilities and agentic risk
Overview
This diagramming skill is mostly purpose-aligned, but it sends diagram content to a fixed remote service and has unsafe local file-writing and credential practices that warrant review before installation.
Review this before installing if your diagrams may include proprietary systems, code structure, customer workflows, or secrets. The skill uploads selected diagram/request content to https://pptx.chenxitech.site, may use a bundled shared API key, and writes returned diagram code locally. Use only in a workspace where remote processing is acceptable, prefer your own API key, and avoid running the included E2E test or trusting backend-returned filenames until the path and command-injection issues are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_contextweave.cjs:89- Finding
Server-Controlled Path Traversal in Generated CW Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/edit_contextweave.cjs:67- Finding
Server-Controlled Path Traversal in Edited CW Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/test_link_e2e.cjs:13- Finding
Shell Command Injection Through Backend-Controlled Session Identifier
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (35)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **特殊场景（导入已有文件）**：当用户在输入中明确提供了现成的绘图文件（如 `.cw`）并要求导入或绘图时，**禁止**重新生成结构化意图文件或调用 `generate_contextweave.cjs`，也**禁止**仅以文本形式输出命令，必须直接使用工具调用 `node scripts/import_cont
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **第二步（属性注入）**：在用户确认生成的结构满足预期后，发起第二次编辑调用（使用 `edit_contextweave.cjs`），明确指示“请为图中的某某节点添加对应的 `link: <绝对文件路径>` 属性”。这种做法可利用后端的精确路由，将链接修改任务交由更适合处理结构化属性的工具完成。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **第二步（属性注入）**：在用户确认生成的结构满足预期后，发起第二次编辑调用（使用 `edit_contextweave.cjs`），明确指示“请为图中的某某节点添加对应的 `link: <绝对文件路径>` 属性”。这种做法可利用后端的精确路由，将链接修改任务交由更适合处理结构化属性的工具完成。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **第二步（属性注入）**：在用户确认生成的结构满足预期后，发起第二次编辑调用（使用 `edit_contextweave.cjs`），明确指示“请为图中的某某节点添加对应的 `link: <绝对文件路径>` 属性”。这种做法可利用后端的精确路由，将链接修改任务交由更适合处理结构化属性的工具完成。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/cw_client.cjs`：用于统一后端请求与响应适配；承载鉴权、错误归一和返回结构解析
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The client embeds a fallback API key directly in source code and automatically uses it when the environment variable is absent. This exposes a reusable credential to anyone with code access and enables unauthorized use of the remote service under the vendor's account, creating both abuse risk and hidden outbound authenticated access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written entirely in Chinese and the document provides no indication that users may choose another language or locale. This creates a natural-language policy issue because the skill appears to impose a specific language experience without documented opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents automatic local persistence of generated
cw_codeinto<session_id>.cwfiles, but this write behavior is not clearly disclosed in the main description. Silent local writes can leave sensitive architecture data on disk unexpectedly, increasing exposure to other local users, backup systems, or later unintended sharing.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill explicitly supports exporting or recovering stored CW code by session ID, which expands its capability from diagram generation into retrieval of previously stored server-side content. If session IDs are exposed, guessed, or reused across contexts, this can enable unauthorized access to prior diagram data that may contain sensitive architecture or business information.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that it sends drawing data and API credentials to a hard-coded remote server, while this network behavior is not clearly disclosed in the top-level description. This creates a material data exfiltration risk because user-provided architecture diagrams, file-derived content, and credentials are transmitted to an external service outside the local environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Network transmission of drawing data and API credentials to an external server is only disclosed deep in the skill body rather than prominently in the top-level description. Because the skill can process architecture and workflow information, insufficient disclosure materially increases the risk of users unknowingly sending sensitive internal data to a third party.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Several recovery hints and error messages are hardcoded in Chinese, including messages like '内部错误: 基础URL缺失' and '请使用官方域名', with no indication that the user can choose language or locale. This creates a language policy concern because the skill imposes a specific language for user-facing output without opt-in or documented locale scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The request method sends payloads containing user input and, in other code paths, local file contents to an external host. The skill description emphasizes diagram generation but does not clearly disclose that data is transmitted off-host to third-party infrastructure, which creates a privacy and data-handling risk for sensitive prompts or documents.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
When an input file is provided, the code reads its contents and places them into payload.user_request and payload.initial_cw_code for remote submission. This can exfiltrate confidential local material to the external service without a clearly stated disclosure in the skill metadata, which is especially risky in an agent environment that may process proprietary documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This flow packages file-derived content and user request data and transmits it to the remote /run endpoint without any user-facing warning in the code path. In the context of a diagramming skill, this is dangerous because users may assume local transformation while sensitive architecture, code, or business-process details are actually sent to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The importCode path reads diagram.cw from the local filesystem and sends its contents to /session/import on the remote service without presenting any warning or disclosure. Even if the file is 'just diagram code,' it may encode proprietary architecture or business logic, so silent upload is a real confidentiality concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The error message and recovery hint are hard-coded in Chinese, which imposes a specific language on users without offering a choice or documenting a locale-specific constraint. This is a natural-language policy issue because the skill does not provide language selection or opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The missing-arguments message and recovery hint are presented only in Chinese, forcing a locale choice on all users. The file does not indicate that this is a region-specific tool or offer any language opt-in.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/test_link_e2e.cjs:15